CVE-2026-45368
HighCVSS 8.4Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
In Kirby CMS versions prior to 4.9.1 and 5.4.1, a vulnerability was found where URL methods for KirbyTags and image blocks components did not filter malicious URL values that resolve to script execution. Attackers can use URL formats like `javascript://x%0A…` to bypass protection against simple `javascript:` URLs and execute scripts.
Risk Assessment
The risk for the organization is the potential injection of malicious JavaScript code by an editor, which could lead to session data theft, account takeover, or other XSS attacks on end users.
Recommendation
It is recommended to immediately update Kirby to version 4.9.1 or 5.4.1, which contain the fix for this vulnerability.
Other vulnerabilities in Kirby CMS
See all- CVE-2026-45334Medium
In Kirby CMS versions prior to 4.9.1 and 5.4.1, the content-locking feature exposed user email addresses and identifiers without checking access permissions. A low-privilege authenticated user could learn the email and ID of any user currently editing a model, including administrators.
- CVE-2026-44177High
In Kirby CMS versions 5.3.0 through 5.4.0, a path traversal vulnerability was found due to improper validation of user IDs. An attacker could include arbitrary PHP files named index.php and probe the server's directory structure.
- CVE-2026-44176Medium
In Kirby CMS versions prior to 4.9.1 and 5.4.1, the `pages.access` permission was not checked during page draft rendering. An authenticated attacker with knowledge of the full path to an existing draft could access its frontend preview, leading to disclosure of sensitive information.
- CVE-2026-44175High
Kirby CMS versions prior to 4.9.1 and 5.4.1 do not properly sanitize the list field content on save, allowing XSS attacks. An attacker can bypass the Panel and send malicious HTML directly to the API, which will be executed in visitors' browsers.
- CVE-2026-44174High
Kirby CMS before versions 4.9.1 and 5.4.1 does not validate model attributes used in collection queries, allowing attackers to invoke arbitrary model methods. This can lead to disclosure of sensitive data (e.g., password hashes, filesystem paths) or execution of impactful actions (e.g., privilege escalation, mass deletion of models).
- CVE-2026-54004Medium
In Kirby CMS before versions 4.9.4 and 5.4.4, with content.fileRedirects enabled, unauthenticated clean file URL requests for files in top-level draft pages are redirected to physical media URLs without checking page access permissions or preview tokens, leading to disclosure of draft file contents.
- CVE-2026-54002High
A vulnerability in Kirby CMS before versions 4.9.4 and 5.4.4 allows stored cross-site scripting via malicious markup injected as children of unknown HTML/XML tags. The sanitization functions fail to properly filter such input.
- CVE-2026-50188Medium
A vulnerability in Kirby CMS allows HTTP header injection via newline characters in the header value of the headers option in the Http Remote class. An attacker can inject an unintended header into outgoing requests.
- CVE-2026-49276High
A vulnerability in the Kirby content management system allows a scripting link to be injected as the target of a link in the writer field, enabling self-cross-site scripting (XSS) in the Panel. The issue affects versions prior to 4.9.4 and 5.4.4.
- CVE-2026-49274Medium
A vulnerability in the Kirby content management system allows authenticated users with the pages.access permission disabled to confirm the existence of inaccessible pages and retrieve their titles via the pages field. The issue is fixed in versions 4.9.4 and 5.4.4.
Original NVD description (English source)
Kirby is an open-source content management system. In versions prior to 4.9.1 and 5.4.1, the underlying URL methods for the KirbyTags and image blocks components did not filter out malicious URL values that resolve to script execution. The vulnerability affects four first-party Kirby renderers that produce `<a href="…">` output from editor-supplied field values: the (`link: …)` KirbyTag, the `link`: parameter of the `(image: …)` KirbyTag when it does not resolve to a known file or `self`, the `link` field of the built-in image block, and the HTML importer for the `blocks` field (which accepted the same malicious input as the image block `link` field). While simple `avascript:` URLs were already deactivated by treating them as a relative path and prepending a single slash to the URL, the use of URLs of the format `javascript://x%0A…` bypasses this protection. The `vbscript:`, `data:`, `livescript:`, `mocha:` and `jar:` schemes are affected by the same underlying gap. This issue has been fixed in versions 4.9.1 and 5.4.1.